ramm 0.0.33 → 0.0.35

package/dist/ramm.js

@@ -175,6 +175,63 @@ var createSystemdService = async (context, serviceName, pathToServiceFile) => {
   await execCommand(formatUserspace(context, `sysyemctl start ${serviceName}`));
 };
 
+// src/nft.ts
+var createNftTable = ({
+  allowedIpV4,
+  allowedPorts
+}) => {
+  const nftTable = `table inet ramm {
+    set allowed_ipv4 {
+      type ipv4_addr
+      flags dynamic
+      elements = { ${allowedIpV4.join(`
+	`)} }
+    }
+
+    chain local_chain_base {
+      iif "lo" accept
+      ct state established,related accept
+      ip saddr @allowed_ipv4 tcp dport 22 accept
+      tcp dport 22 ct state new limit rate over 700/minute burst 5 packets drop
+      tcp dport 22 accept
+      ${allowedPorts.map((port) => {
+    return `tcp dport ${port} accept`;
+  }).join(`
+`)}
+    }
+
+    chain local_chain {
+      jump local_chain_base
+      drop
+    }
+
+    chain prerouting {
+      type filter hook prerouting priority mangle; policy accept;
+      fib daddr type local jump local_chain
+    }
+  }
+  `;
+  return nftTable;
+};
+var setupNftable = async ({
+  allowedIpV4,
+  allowedPorts
+}) => {
+  const listTable = await execCommand("nft list table inet ramm");
+  if (listTable.spawnResult.exitCode === 0) {
+    await execCommand("nft delete table inet ramm");
+  }
+  const nftTable = createNftTable({ allowedIpV4, allowedPorts });
+  await execCommand(`nft -f - <<EOF
+${nftTable}
+EOF`);
+  await safeNftTable();
+};
+var safeNftTable = async () => {
+  await execCommand("nft list ruleset > /etc/nftables.conf");
+  await execCommand("systemctl enable nftables");
+};
+
 // src/podman.ts
 var installPodman = async () => {
   if ((await $2`command -v podman`.nothrow().quiet()).exitCode !== 0) {
@@ -223,50 +280,7 @@ var addNftPodmanRule = async () => {
 `);
   await execCommand(`nft add set inet ramm podman_interfaces '{ type ifname; flags dynamic; elements = { ${podmanNetworks.join(", ")} }; }'`);
   await execCommand("nft insert rule inet ramm prerouting iifname @podman_interfaces accept");
-};
-// src/nft.ts
-var createNftTable = ({ allowedIpV4 }) => {
-  const nftTable = `table inet ramm {
-    set allowed_ipv4 {
-      type ipv4_addr
-      flags dynamic
-      elements = { ${allowedIpV4.join(`
-	`)} }
-    }
-
-    chain local_chain_base {
-      iif "lo" accept
-      ct state established,related accept
-      ip saddr @allowed_ipv4 tcp dport 22 accept
-      tcp dport 22 ct state new limit rate over 700/minute burst 5 packets drop
-      tcp dport 22 accept
-      tcp dport 80 accept
-      tcp dport 443 accept
-    }
-
-    chain local_chain {
-      jump local_chain_base
-      drop
-    }
-
-    chain prerouting {
-      type filter hook prerouting priority mangle; policy accept;
-      fib daddr type local jump local_chain
-    }
-  }
-  `;
-  return nftTable;
-};
-var setupNftable = async ({
-  allowedIpV4
-}) => {
-  await execCommand("nft flush ruleset");
-  const nftTable = createNftTable({ allowedIpV4 });
-  await execCommand(`nft -f - <<EOF
-${nftTable}
-EOF`);
-  await execCommand("nft list ruleset > /etc/nftables.conf");
-  await execCommand("systemctl enable nftables");
+  await safeNftTable();
 };
 // src/files.ts
 import { appendFile, exists } from "fs/promises";

package/dist/types/nft.d.ts

@@ -1,4 +1,6 @@
 export declare const localNftChainName = "local_chain";
-export declare const setupNftable: ({ allowedIpV4, }: {
+export declare const setupNftable: ({ allowedIpV4, allowedPorts, }: {
     allowedIpV4: string[];
+    allowedPorts: string[];
 }) => Promise<void>;
+export declare const safeNftTable: () => Promise<void>;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ramm",
   "type": "module",
-  "version": "0.0.33",
+  "version": "0.0.35",
   "scripts": {
     "build": "bun build ./src/ramm.ts --target bun --outdir ./dist && cp ./src/bun.sh ./dist/bun.sh",
     "types": "tsc --project tsconfig.types.json"